Extracted

Extracted

• • Target

    9b60c72f57fcfb1afd5db10a52e7027d0692598f7f1ffd5d01cd98e4ecdd3bca

  • Size

    660KB

  • MD5

    f65f9af4291db9f7fb5c372f456b9fea

  • SHA1

    0035ff92981afd0756581ce00ec46c031cfb0d2b

  • SHA256

    9b60c72f57fcfb1afd5db10a52e7027d0692598f7f1ffd5d01cd98e4ecdd3bca

  • SHA512

    aeb8c9c10a64209257fce95e39b3d9de3ab9bee8f9d9cea4a26e51248f96fea69873040678e301d7a1c47f32f3570a5dc952bd48445f46c679af868694af48a1

  • SSDEEP

    12288:vMrDy90H55kapuaHV8L/IGfpBDl1nmowHb+8bXdQxZSM19HGl615vwuTX0:MygGQ8LQkBDzmZM14svw8X0

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1